NNSNAHSL.SYS causing non-paged memory leak

Find the answers to Adaptive Defense and Endpoint Protection queries in this forum. The experts will help you out!
lmp
Registered user
Registered user
Posts: 21
Joined: Thu, 23 Apr 2015, 17:02

NNSNAHSL.SYS causing non-paged memory leak

Post by lmp »

I recently started noticing some issues with one of our servers, the OS is Windows Server 2012 R2.
After having to forcibly restart the server after it became virtually unresponsive I started to keep an eye on the memory.
At one point I noticed that 90% of the server's RAM (9GB) was being allocated by two instances tagged as LHAN and YHAN in the non-paged area.

Looking through all the system drivers there was one which contained both strings: NNSNAHSL.SYS
More specifically:

Code: Select all

File description: Network Activity Hook Server LWF
File version: 6.0.0.68
Product name: Nano Network Security
Product version: 4.2.0.404
Legal copyright: © Panda 2017
Original filename: NNSNAHSL.SYS
Now, after a reboot, there is only the LHAN instance and it is only allocating 259KB.
Just an hour ago I logged on to the server through RDP and the non-paged memory started leaking fast to the point that LHAN and YHAN went from less than 1MB to 2GB in under 2 minutes.
I haven't yet figured a way to trigger the memory leaking, it almost seems random. The firewall is not even enabled but somehow that driver is killing the server by leaking all over the memory.

Is this a known issue and if not can this be looked at urgently or get a workaround?

Image
https://i.stack.imgur.com/VnNPs.png

Image
https://i.stack.imgur.com/xgjEA.png
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by Darth Panda »

Hi,

Could you send us your client number in a private mesage?

Regards

Darth
Technical support – Panda Security
www.pandasecurity.com
lmp
Registered user
Registered user
Posts: 21
Joined: Thu, 23 Apr 2015, 17:02

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by lmp »

The support ticket is still ongoing but in the meantime I isolated the problem to a conflict between the Network Activity Hook Server LWF driver and WinPcap, the leak happens when both are being used at the same time. If, for example, I use Wireshark (WinPcap driver) while Panda is using some networking analysis of it's own (Network Activity Hook Server LWF driver) then the problem os non-paged memory leaking happens, especially with big data transfers across the network, it will fill the RAM (NP area) with as much data as the data being transfered on the network. On the other hand, uninstalling Panda or stopping the usage of WinPcap driver does away with the issue.

I'm still hoping to be able to sue Panda and WinPcap at the same time without having to worry about filling up teh RAM in less than 2 minutes... we'll see.
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by Darth Panda »

Hi,

That is a very interesting point, did you tell support about it? Please let them know via email when they reply to you.

Regards

Darth
Technical support – Panda Security
www.pandasecurity.com
lmp
Registered user
Registered user
Posts: 21
Joined: Thu, 23 Apr 2015, 17:02

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by lmp »

The support staff (higher level, possibly from Spain or US) remotely accessed my system and installed a "newer" or "custom" driver that does not cause the memory leak.

He was not able to specify if this "new" driver will be shipped with the next release, but for now the problem is solved.

EDIT: I forgot to add the description of the new driver:

Code: Select all

File description: Network Activity Hook Server LWF
File version: 6.1.0.72
Product name: Nano Network Security
Product version: 4.2.0.432
Legal copyright: © Panda 2018
Original filename: NNSNAHSL.SYS
Last edited by lmp on Thu, 24 May 2018, 13:24, edited 2 times in total.
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by Darth Panda »

Perfect!!

thanks for the update.

Regards
Technical support – Panda Security
www.pandasecurity.com
benxen
Registered user
Registered user
Posts: 1
Joined: Sat, 08 Dec 2018, 21:00

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by benxen »

Hello

I have the same problem, but i can't find the File version: 6.1.0.72

It's possible to send me this file ?

Thanks
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by Darth Panda »

Hi benxen,

I'm sendig you a PM.

Regards,
Technical support – Panda Security
www.pandasecurity.com
lmp
Registered user
Registered user
Posts: 21
Joined: Thu, 23 Apr 2015, 17:02

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by lmp »

Not sure if still needed, but I also sent a PM with the file requested.
Darth Panda
Official moderator
Official moderator
Posts: 1568
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Post by Darth Panda »

lmp wrote:Not sure if still needed, but I also sent a PM with the file requested.
Hi lmp,

If the problem is solved we don't need the file, but thank you.

Regards
Technical support – Panda Security
www.pandasecurity.com
Locked

Return to “Adaptive Defense and Endpoint Protection - Issues”